logo

Manual Pages

Table of Contents

NAME

na_auditlog- audit record of recent commands executed and their output

SYNOPSIS

<logdir>/auditlog

<logdir> is /etc/log for filers and /logs for NetCache appliances.

DESCRIPTION

If the option auditlog.enable is on, the system logs all input to the system at the console/telnet shell and via rsh to the auditlog file. The data output by commands executed in this fashion is also logged to auditlog. Administrative servlet invocations (via HTTP, typically from FilerView) are also logged. A typical message is:

Wed Feb 9 17:34:09 GMT [rshd_0:auditlog]: root:OUT:date: Wed Feb 9 17:34:09 GMT 2000

This indicates that there was an rsh session around Wed Feb 9 17:34:09 GMT which caused the date command to be executed. The user performing the command was root. The type of log is data output by the system as indicated by the OUT keyword.

Commands typed into the filer or executed by rsh are designated by the IN keyword as in:

Wed Feb 9 17:34:03 GMT [rshd_0:auditlog]: :IN:rsh shell: RSH INPUT COMMAND is date

The start and end of an rsh session are specially demarcated as in

Wed Feb 9 17:34:09 GMT [rshd_0:auditlog]: root:START:rsh shell:orbit.eng.netapp.com

and

Wed Feb 9 17:34:09 GMT [rshd_0:auditlog]: root:END:rsh shell:

The maximum size of the auditlog file is controlled by the auditlog.max_file_size option. If the file gets to this size, it is rotated (see below).

Every Saturday at 24:00, <logdir>/auditlog is moved to <logdir>/auditlog.0, <logdir>/auditlog.0 is moved to <logdir>/auditlog.1, and so on. This process is called rotation. Auditlog files are saved for a total of six weeks, if they do not overflow.

FILES

<logdir>/auditlog
auditlog file for current week. <logdir>/auditlog.[0-5] auditlog files for previous weeks

SEE ALSO

na_options(1)

Table of Contents